Data Evaporating from a SSD

Video: Data Evaporating from a SSD in a Windows 7 PC

Background

Hard disk drives retain data after it is deleted, and even after the disk is reformatted.

Data isn't lost until it is overwritten, and a large part of computer forensics involves recovering this "latent data".

However, this seminal 2010 paper shows that some SSD drives erase the latent data automatically in a process called "garbage collection":

"Solid State Drives: The Beginning of the End for Current Practice in Digital Forensic Recovery?" by Graeme B. Bell and Richard Boddington

I wanted to see this happen, and use it as a class demonstration.

Method

I used a MacBook Air running OS X 10.7.5:

System Information shows that it uses an Apple SSD SM256C with TRIM Support. This means the operating system tells the SSD when data is deleted, to help it in the garbage collection process.

I wrote a trivial bash script to fill a folder with 100 files, each 10,000 bytes in size.

Then I used the rm command to delete the files, and the free version of Disk Drill to recover the deleted files.

The "Quick Scan" in Disk Drill looks only in unallocated space and is very fast, taking only about 2 minutes to locate the recoverable files.

First Test: Files Vanish in Ten Minutes

This image shows the first recovery process I perfomed. On the left side you can see that the rm command was completed at 19:42:56, and that the Disk Drill scan was completed at 7:44 PM (see the clock in the upper right).

Three minutes after file deletion, Disk Drill is able to recover the files--the "test1" folder contains 101 recoverable objects. (I made an extra one testing the script.)

At 7:47 the files are still recoverable:

But at 7:50 the files are gone, as shown below:

The files vanished within ten minutes!

Second Test: Files Vanish in an Hour

I repeated the whole test a second time.

I re-created the files and deleted them again. As you can see on the left of the image below, the files were deleted at 19:59, and two minutes later, at 8:00 PM, they were still recoverable, because the test1 folder contains 100 recoverable files.

This time the files lasted a lot longer. Here's a Disk Drill session more than 30 minutes after the files were deleted, and all the files are still recoverable:

I left the computer alone and returned at 9:21, 82 minutes after the files were deleted, and they were gone.

So the time varies, but data DOES evaporate off the SSD in the MacBook Air.

This is an issue of importance for computer forensics, as explained in the 2010 paper referenced above.


Posted 2-3-13 by Sam Bowne
Windows 7 video added 3-12-13